This can (optionally) contain data showing how messages have been handled (eg deleted, moved, etc)
id - incrementing ID of msgaudit entry
datetime - the date & time the event occurred
component - which VPOP3 component performed the event
owner - which VPOP3 user owned the message
actionuser - which VPOP3 user performed the event
cmd - the command which occurred
ipaddr - the IP address the event was triggered by
sourcefolder - the folder the message was in at the start of the event
targetfolder - the folder the message was in at the end of the event (if it was different from the sourcefolder)
subject - the message subject
sender - the message sender
msgdate - the message date
Note that this logs commands sent to VPOP3's message store, NOT commands sent by the user, so it may not match what you think is happening. For instance, if a user deletes a message, you may see a copy to another folder (eg 'Trash'), then a bit later a message delete, then a bit later a message purge/expunge. That is how the 'delete' operation is actually performed in the background.